1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18
19#include <linux/module.h>
20#include <linux/crypto.h>
21#include <linux/audit.h>
22#include <linux/xattr.h>
23#include <linux/integrity.h>
24#include <linux/evm.h>
25#include <crypto/hash.h>
26#include "evm.h"
27
28int evm_initialized;
29
30static char *integrity_status_msg[] = {
31 "pass", "fail", "no_label", "no_xattrs", "unknown"
32};
33char *evm_hmac = "hmac(sha1)";
34char *evm_hash = "sha1";
35int evm_hmac_attrs;
36
37char *evm_config_xattrnames[] = {
38#ifdef CONFIG_SECURITY_SELINUX
39 XATTR_NAME_SELINUX,
40#endif
41#ifdef CONFIG_SECURITY_SMACK
42 XATTR_NAME_SMACK,
43#ifdef CONFIG_EVM_EXTRA_SMACK_XATTRS
44 XATTR_NAME_SMACKEXEC,
45 XATTR_NAME_SMACKTRANSMUTE,
46 XATTR_NAME_SMACKMMAP,
47#endif
48#endif
49#ifdef CONFIG_IMA_APPRAISE
50 XATTR_NAME_IMA,
51#endif
52 XATTR_NAME_CAPS,
53 NULL
54};
55
56static int evm_fixmode;
57static int __init evm_set_fixmode(char *str)
58{
59 if (strncmp(str, "fix", 3) == 0)
60 evm_fixmode = 1;
61 return 0;
62}
63__setup("evm=", evm_set_fixmode);
64
65static void __init evm_init_config(void)
66{
67#ifdef CONFIG_EVM_ATTR_FSUUID
68 evm_hmac_attrs |= EVM_ATTR_FSUUID;
69#endif
70 pr_info("HMAC attrs: 0x%x\n", evm_hmac_attrs);
71}
72
73static int evm_find_protected_xattrs(struct dentry *dentry)
74{
75 struct inode *inode = d_backing_inode(dentry);
76 char **xattr;
77 int error;
78 int count = 0;
79
80 if (!inode->i_op->getxattr)
81 return -EOPNOTSUPP;
82
83 for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) {
84 error = inode->i_op->getxattr(dentry, *xattr, NULL, 0);
85 if (error < 0) {
86 if (error == -ENODATA)
87 continue;
88 return error;
89 }
90 count++;
91 }
92
93 return count;
94}
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109static enum integrity_status evm_verify_hmac(struct dentry *dentry,
110 const char *xattr_name,
111 char *xattr_value,
112 size_t xattr_value_len,
113 struct integrity_iint_cache *iint)
114{
115 struct evm_ima_xattr_data *xattr_data = NULL;
116 struct evm_ima_xattr_data calc;
117 enum integrity_status evm_status = INTEGRITY_PASS;
118 int rc, xattr_len;
119
120 if (iint && iint->evm_status == INTEGRITY_PASS)
121 return iint->evm_status;
122
123
124
125
126 rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0,
127 GFP_NOFS);
128 if (rc <= 0) {
129 evm_status = INTEGRITY_FAIL;
130 if (rc == -ENODATA) {
131 rc = evm_find_protected_xattrs(dentry);
132 if (rc > 0)
133 evm_status = INTEGRITY_NOLABEL;
134 else if (rc == 0)
135 evm_status = INTEGRITY_NOXATTRS;
136 } else if (rc == -EOPNOTSUPP) {
137 evm_status = INTEGRITY_UNKNOWN;
138 }
139 goto out;
140 }
141
142 xattr_len = rc;
143
144
145 switch (xattr_data->type) {
146 case EVM_XATTR_HMAC:
147 rc = evm_calc_hmac(dentry, xattr_name, xattr_value,
148 xattr_value_len, calc.digest);
149 if (rc)
150 break;
151 rc = memcmp(xattr_data->digest, calc.digest,
152 sizeof(calc.digest));
153 if (rc)
154 rc = -EINVAL;
155 break;
156 case EVM_IMA_XATTR_DIGSIG:
157 rc = evm_calc_hash(dentry, xattr_name, xattr_value,
158 xattr_value_len, calc.digest);
159 if (rc)
160 break;
161 rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
162 (const char *)xattr_data, xattr_len,
163 calc.digest, sizeof(calc.digest));
164 if (!rc) {
165
166
167
168 if (!IS_RDONLY(d_backing_inode(dentry)) &&
169 !IS_IMMUTABLE(d_backing_inode(dentry)))
170 evm_update_evmxattr(dentry, xattr_name,
171 xattr_value,
172 xattr_value_len);
173 }
174 break;
175 default:
176 rc = -EINVAL;
177 break;
178 }
179
180 if (rc)
181 evm_status = (rc == -ENODATA) ?
182 INTEGRITY_NOXATTRS : INTEGRITY_FAIL;
183out:
184 if (iint)
185 iint->evm_status = evm_status;
186 kfree(xattr_data);
187 return evm_status;
188}
189
190static int evm_protected_xattr(const char *req_xattr_name)
191{
192 char **xattrname;
193 int namelen;
194 int found = 0;
195
196 namelen = strlen(req_xattr_name);
197 for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
198 if ((strlen(*xattrname) == namelen)
199 && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) {
200 found = 1;
201 break;
202 }
203 if (strncmp(req_xattr_name,
204 *xattrname + XATTR_SECURITY_PREFIX_LEN,
205 strlen(req_xattr_name)) == 0) {
206 found = 1;
207 break;
208 }
209 }
210 return found;
211}
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229enum integrity_status evm_verifyxattr(struct dentry *dentry,
230 const char *xattr_name,
231 void *xattr_value, size_t xattr_value_len,
232 struct integrity_iint_cache *iint)
233{
234 if (!evm_initialized || !evm_protected_xattr(xattr_name))
235 return INTEGRITY_UNKNOWN;
236
237 if (!iint) {
238 iint = integrity_iint_find(d_backing_inode(dentry));
239 if (!iint)
240 return INTEGRITY_UNKNOWN;
241 }
242 return evm_verify_hmac(dentry, xattr_name, xattr_value,
243 xattr_value_len, iint);
244}
245EXPORT_SYMBOL_GPL(evm_verifyxattr);
246
247
248
249
250
251
252
253
254static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
255{
256 struct inode *inode = d_backing_inode(dentry);
257
258 if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode)
259 return 0;
260 return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
261}
262
263
264
265
266
267
268
269
270
271
272
273
274
275static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
276 const void *xattr_value, size_t xattr_value_len)
277{
278 enum integrity_status evm_status;
279
280 if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
281 if (!capable(CAP_SYS_ADMIN))
282 return -EPERM;
283 } else if (!evm_protected_xattr(xattr_name)) {
284 if (!posix_xattr_acl(xattr_name))
285 return 0;
286 evm_status = evm_verify_current_integrity(dentry);
287 if ((evm_status == INTEGRITY_PASS) ||
288 (evm_status == INTEGRITY_NOXATTRS))
289 return 0;
290 goto out;
291 }
292 evm_status = evm_verify_current_integrity(dentry);
293 if (evm_status == INTEGRITY_NOXATTRS) {
294 struct integrity_iint_cache *iint;
295
296 iint = integrity_iint_find(d_backing_inode(dentry));
297 if (iint && (iint->flags & IMA_NEW_FILE))
298 return 0;
299
300
301 if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
302 || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
303 return 0;
304
305 integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
306 dentry->d_inode, dentry->d_name.name,
307 "update_metadata",
308 integrity_status_msg[evm_status],
309 -EPERM, 0);
310 }
311out:
312 if (evm_status != INTEGRITY_PASS)
313 integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
314 dentry->d_name.name, "appraise_metadata",
315 integrity_status_msg[evm_status],
316 -EPERM, 0);
317 return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
318}
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
334 const void *xattr_value, size_t xattr_value_len)
335{
336 const struct evm_ima_xattr_data *xattr_data = xattr_value;
337
338 if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
339 if (!xattr_value_len)
340 return -EINVAL;
341 if (xattr_data->type != EVM_IMA_XATTR_DIGSIG)
342 return -EPERM;
343 }
344 return evm_protect_xattr(dentry, xattr_name, xattr_value,
345 xattr_value_len);
346}
347
348
349
350
351
352
353
354
355
356int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
357{
358 return evm_protect_xattr(dentry, xattr_name, NULL, 0);
359}
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
375 const void *xattr_value, size_t xattr_value_len)
376{
377 if (!evm_initialized || (!evm_protected_xattr(xattr_name)
378 && !posix_xattr_acl(xattr_name)))
379 return;
380
381 evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
382}
383
384
385
386
387
388
389
390
391
392
393
394void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
395{
396 if (!evm_initialized || !evm_protected_xattr(xattr_name))
397 return;
398
399 evm_update_evmxattr(dentry, xattr_name, NULL, 0);
400}
401
402
403
404
405
406int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
407{
408 unsigned int ia_valid = attr->ia_valid;
409 enum integrity_status evm_status;
410
411 if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))
412 return 0;
413 evm_status = evm_verify_current_integrity(dentry);
414 if ((evm_status == INTEGRITY_PASS) ||
415 (evm_status == INTEGRITY_NOXATTRS))
416 return 0;
417 integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
418 dentry->d_name.name, "appraise_metadata",
419 integrity_status_msg[evm_status], -EPERM, 0);
420 return -EPERM;
421}
422
423
424
425
426
427
428
429
430
431
432
433
434void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
435{
436 if (!evm_initialized)
437 return;
438
439 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
440 evm_update_evmxattr(dentry, NULL, NULL, 0);
441}
442
443
444
445
446int evm_inode_init_security(struct inode *inode,
447 const struct xattr *lsm_xattr,
448 struct xattr *evm_xattr)
449{
450 struct evm_ima_xattr_data *xattr_data;
451 int rc;
452
453 if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
454 return 0;
455
456 xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
457 if (!xattr_data)
458 return -ENOMEM;
459
460 xattr_data->type = EVM_XATTR_HMAC;
461 rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
462 if (rc < 0)
463 goto out;
464
465 evm_xattr->value = xattr_data;
466 evm_xattr->value_len = sizeof(*xattr_data);
467 evm_xattr->name = XATTR_EVM_SUFFIX;
468 return 0;
469out:
470 kfree(xattr_data);
471 return rc;
472}
473EXPORT_SYMBOL_GPL(evm_inode_init_security);
474
475static int __init init_evm(void)
476{
477 int error;
478
479 evm_init_config();
480
481 error = evm_init_secfs();
482 if (error < 0) {
483 pr_info("Error registering secfs\n");
484 goto err;
485 }
486
487 return 0;
488err:
489 return error;
490}
491
492
493
494
495static int __init evm_display_config(void)
496{
497 char **xattrname;
498
499 for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++)
500 pr_info("%s\n", *xattrname);
501 return 0;
502}
503
504pure_initcall(evm_display_config);
505late_initcall(init_evm);
506
507MODULE_DESCRIPTION("Extended Verification Module");
508MODULE_LICENSE("GPL");
509